About

Controls is where a client keeps its own library of controls: the safeguards the client says it has in place. Controls are grouped into control sets and control families. Each control has an owner and an implementation status, and you can map it to framework objectives, evidence, risks and documents. Because one control can be mapped to objectives from any framework, the same work can count toward several frameworks at once.

Controls is organized in three levels, and each level has a breadcrumb back to the one above:

• Control sets: a named collection of controls, for example a baseline or your own list.
• Control families: groups of related controls inside a set.
• Controls: one safeguard each, with a code that is unique inside its set.

A control belongs to exactly one set and one family.

Super Admins and Compliance Managers manage control sets, families and controls. Only they can change a control's owner, family or set. A control's owner can edit the control's other fields, such as its status and summary.

Open Controls and a control set

The sidebar item is Manage › Controls. It sits outside any single framework. The page it opens is headed "Control Sets" and lists every set for the client.

The toolbar shows how many control sets there are ("Showing N control sets") and has a Search control sets box, Import, Display and New Control Set. Click Display to switch between the Cards and Table views.

Each card shows:

• A progress label: Empty, Not started, In progress or Implemented.
• The set's name and description.
• The number of control families.
• How many controls are implemented, for example "X of Y implemented".
• The owner.

The Table view has the columns Control set, Owner, Progress, Families, Description and Actions. In either view, click a set to open it.

You can also find a control from the search box at the top of the page (LaunchPad), and controls linked from an objective, an evidence item or a risk open straight to the control's page.

Work in the controls list

Inside a set, the page is titled with the set's name and lists its controls. The list loads more rows as you scroll and ends with "All controls loaded".

The toolbar has a Search controls box, Filter, Display, Import and Actions. The table has these columns:

• Code and Control: the control's code and name. Click the name to open the control. Click the Code or Control header to sort. The list opens sorted by Code.
• Owner: the control's owner. You can change it from the row.
• Status: the control's implementation status. You can change it from the row.
• Auto audit: the result of the control's automatic checks, such as Passing or Failing. Click it to see more and to retest.
• Actions: the "…" menu for the row.

Click the Auto audit result for a panel with Retest. For a control that is failing, the panel also shows Why is this control failing?. Auto audit is separate from the control's status: it shows what the connected checks found, while the status is what you record.

Change what the list shows

Click Display to change how the list looks.

The menu has these parts:

• View: List or Families. In the Families view, each control family is a card with its code, name, description, number of controls and how many are implemented. Click a family to see only its controls.
• Columns: switches for Code, Control, Owner, Status, Auto audit, Links, Type, Priority and Comments. Links, Type, Priority and Comments are off until you turn them on. When Links is on, click the count (for example "14 linked") to see the control's linked evidence, requirements and action items.
• Reset to default: puts the view and columns back to how they were.

Use Search controls to find a control by name, and Filter to narrow the list.

Assign or delete several controls

1. Tick the box beside each control you want. Tick the box in the header to select every control that matches your current search and filters.
2. In the bar that appears, click Assign or Delete.
3. For Assign, pick a user in the dialog and click Assign. For Delete, confirm in the dialog.

Deleting controls is permanent and cannot be undone. The "…" menu on a row also has Upload evidence, which attaches a file to that control as evidence, and Delete.

Review and update a control

Click a control's name in the list to open it. The control's code and name are at the top, with Add New, Map item and arrows to the previous and next control in the list. A back arrow returns you to where you came from.

A control has these tabs:

• Overview: the control's summary and details.
• Evidence: evidence mapped to the control.
• Action Items: action items linked to the control.
• Documents: policies, procedures and governance documents mapped to the control.
• Risks: risks mapped to the control.
• Audit tests: past audit test results.
• Settings: Test Frequency, Control Set and Control Family.
• Mappings: the framework objectives the control satisfies.
• Comments, Watchers and Activity: discussion, who follows the control, and its history.

Contributors see a smaller view of a control, without the Evidence and Mappings tabs.

The Overview tab

The Overview tab shows these fields:

• Summary: a short description of the control.
• Status: Not Implemented, Partially Implemented, Implemented, Alternative Implementation, In Progress / Planned or Not Applicable.
• Auto audit: the result of the control's automatic checks.
• Owner and Team.
• Effectiveness: Not Performed, Performed Informally, Planned & Tracked, Automated, Quantitatively Measured or Continuously Improving.
• Priority: Not set, Low, Medium, High or Critical.
• Control type: Not set, Preventive, Corrective or Detective.
• Control family, Frequency, Contributors and Tags.
• Last updated.
• Implementation narrative: a place to describe how the control is carried out. Some controls have further implementation fields below it.

Only a Super Admin, a Compliance Manager or the control's owner can edit these fields.

To change the status or owner, pick a new value on the control's Overview tab or straight from its row in the list. Marking a control Implemented or Partially Implemented also reruns its automatic checks.

Add or link related records

Use the buttons at the top of a control to connect other records to it:

• Add New: creates a new Risk, Evidence, Action Item, Policy, Procedure or Governance document and links it to this control.
• Map item: links an existing Policy, Procedure, Governance Document, Risk, Evidence, Rule or Report to this control.

Map a control to framework objectives

Mapping ties a control to the framework objectives it satisfies. You can map a control to objectives from any framework. The control then appears under each of those objectives, which is how one control covers several frameworks.

1. Open the control and click the Mappings tab.
2. Click the search box and type at least 3 characters of an objective's code or name.
3. Select the objective from the results to map it.

The tab lists every mapped objective under Framework Objectives, with a count. Click an objective to open it in a new browser tab. To remove a mapping, click the unlink icon at the end of the objective's row.

Add controls from a ready-made library

You can add a ready-made set of controls instead of typing them in.

1. On the Control Sets page, click Import. The "Select core controls for your environment" panel lists the ready-made control sets.
2. Find the set you want and click Import beside it. If the set comes with evidence, an Include evidence checkbox is shown.
3. In the "Control Set Import" dialog, click Start Import.

The import can take up to a minute, and you can keep working while it runs. When it finishes, a message reads "Control set imported successfully."

To add a library into a set you already have, open the set and click Import › From library.

Import controls from a file

1. Open the control set and click Import › From a file.
2. Choose your file.
3. Match the columns in your file to the control fields.
4. Confirm the import.

The file is checked before the controls are imported. When it finishes, a message tells you how many rows were inserted.

Create a control set

1. On the Control Sets page, click New Control Set.
2. In the "Create Control Set" panel, fill in the Control set name, Control set identifier (3 to 5 letters or numbers), Control set owner and Control set description.
3. Confirm to create the set.

To change a set later, click the "…" menu on its card (or the row in the Table view) and choose Edit Control Set.

Create a control family

1. Open the control set and click Actions › Create Control Family.
2. In the "Create Control Family" panel, fill in the Control Family Name, Control Family Identifier (3 to 5 letters, numbers, periods or hyphens) and Control Family Description. The control set is shown for reference.
3. Confirm to create the family.

Create a custom control

A control always lives in a set and a family, so create the family first if you need a new one.

1. Open the control set.
2. Click Actions › Create Control. The "Create control" dialog opens.
3. Fill in the dialog:
   • Control name (required).
   • Control family: choose a family. If you opened a family first, it is already chosen.
   • Owner: choose a user.
   • Control type: Unspecified, Preventive, Corrective or Detective.
   • Description.
4. Click Create control.

Set the new control's status and map it to objectives, evidence and other records afterward, on the control's own page.

Export a control set

On the Control Sets page, click the "…" menu on a set's card (or its row in the Table view) and choose Download Control Set. A message confirms that the download has been requested. The same menu has Relationship Report, which opens a "Control Relations Report" panel showing how the set's controls relate to other records.

Delete a control, family or set

Deleting a control, a control family or a control set is permanent. Deleting a control asks you to confirm before it is removed. Deleting a set asks "Deleting Control Set?" and deleting a family asks "Deleting Control Family?". To delete a set, use Delete Control Set in its card's "…" menu. To delete a family, use Delete in the "…" menu on its card in the Families view.

How progress is counted

Progress on a set or family is the number of implemented controls out of the total. Only the status Implemented counts as implemented. The progress label on a card also shows Empty when there is nothing to count. The other labels follow these rules:

• Not started: no control is implemented, partly implemented or in progress.
• In progress: at least one control is implemented or in progress.
• Implemented: every control is implemented.